A new lawsuit claims that Confide, a privacy-focused messaging app reportedly used by several politicians including those in the Trump administration in February, may not be as secure as it has advertised.
Filings from a proposed class-action lawsuit in New York say that Confide's contention that it does not allow its users to take screenshots of their messages isn't true. It specifically accuses Confide of breaching false advertising and deceptive business practices laws.
The inability to keep a record of Confide messages is one of the product's most-touted features. If someone tries to take a picture of a conversation, Confide is supposed to kick out the person who took the screenshot and alert the other person in the conversation. It's also supposed to only let users see messages one line at a time, to prevent an entire message from ever being recorded, making it ideal for confidential messaging. The website suggests “common use cases include: Job referrals, HR issues, deal discussions, and even some good-natured office gossip.”
Confide co-founder Jon Brod said in a statement Thursday that the allegations are “unfounded and without merit.” “We look forward to responding to this frivolous complaint and seeing this case swiftly thrown out of court,” he said.
The court filing includes screenshots of full messages that the complaint says were taken on personal computers running the Windows version of the app.
The filing also claims that, using certain settings, both the MacOS and Windows versions of Confide show all of a message at once and fail to notify users when someone in the conversation takes a screenshot.
Lead plaintiff Jeremy Auman said in the filing that he would not have paid his $6.99 per month subscription fee if he knew his messages could be exposed this way and that he stopped using the app to send sensitive messages after finding out that it did not provide the security features it claimed.
“Confide failed to engineer its Windows version of its App with screenshot protection,” the filing said. “And in so doing, Confide ensured that any message sent through its messaging platform is (and has been) at risk of storage. Consumers who erroneously thought they were using a secure platform to send confidential and potentially compromising information are now at great risk of having that information used against them.”
Security researchers in February also questioned Confide's security claims, saying it was possible to intercept encrypted messages on the service. Brod denied those claims, calling the research “slightly misleading,” TechCrunch reported.
The app, first launched a few years ago, has seen a spike in downloads since the U.S. election; there have been many reports that political operatives on both side of the aisle use it for their communications. Several similar apps, including Whisper, Signal and Wickr, have also been used for years by politicians worried about hacks or interested in keeping their communications secret.
Auman is being represented by Edelson, a Chicago-based firm that has taken on several class actions against tech companies, including one filed Tuesday against headphone maker Bose. Edelson has also led users in suits against smart vibrator maker WeVibe and Jay Z's music service, Tidal, as well as Amazon, Google, Facebook and Apple. (Amazon chief executive Jeffrey P. Bezos is the owner of The Washington Post.)
Sam Altman, president of Y Combinator, once told the New York Times that the law firm's founder Jay Edelson was seen by tech companies as “a leech tarted up as a freedom fighter.” But the firm boasts results, including delivering at least $1 billion in settlements to its clients, and has emerged as a prominent law firm, particularly on privacy issues.
Edelson lawyer Christopher Dore highlighted the importance of privacy in a statement about the firm's latest case. “Individuals ranging from an average consumer all the way up to government officials at the highest level have realized the importance of secure communications,” he said. “Our suit seeks to hold Confide accountable to the level of security it promised.”
The suit is filed in the U.S. District Court for the Southern District of New York.